Stay organized with collections
Save and categorize content based on your preferences.
This document describes how to group and view log entries in a "parent-child"
format using the Logs Explorer. Usually when you write log entries to
Cloud Logging, each log entry appears separately and uncorrelated. However,
you can group, or correlate your log entries by using the trace field in the
LogEntry object.
When you correlate log entries, you can view a parent log entry with multiple
child log entries in the Logs Explorer.
Set up correlated log entries
To set up correlated log entries, you can manually populate the trace field,
or you can instrument your application to submit traces to Cloud Trace by
using Google client libraries. The following configurations automatically
capture your trace data:
If you use the search bar to find this page, then select the result whose subheading is
Logging.
In the Resource drop-down menu, select GAE Application.
In the Log Name drop-down menu, select request_log.
In the Query results pane, to expand a log entry,
click chevron_rightExpand.
Application log entries correlated to the request log entry are nested in the request log entry:
In the previous screenshot, the parent log entry has 10 child log entries.
You can expand these child log entries to view their details.
Search correlated log entries
Correlated search lets you search both parent and child log entries with a query.
The result of the search is a list of parent log entries that match the query in
either the parent or child log entries. For example, to search for the string
"app log message" in both the child and parent log entries, do the following:
In the Google Cloud console, go to the Logs Explorer page:
If you use the search bar to find this page, then select the result whose subheading is
Logging.
Enter "app log message" in the search field, and click Run query.
Child log entries containing "app log message" are listed in the Query
results pane.
In the Query results pane, click Correlate by and select a parent
log. To view App Engine request logs, select request_log, and click
Apply.
In the Query results pane, all parent log entries that contain the
string "app log message" or that have a child that contain the string are
listed.
To view nested child log entries, tp expand the parent log entry,
click chevron_rightExpand.
In the previous screenshot, the parent log entry has 10 child log entries
that contain the string "app log message". You can expand these child log
entries to view their details.
If you selected a parent log and see no log entries in the Query results
pane, then there are no correlated parent and child entries that match your
query.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-29 UTC."],[],[],null,["# Correlate log entries\n\nThis document describes how to group and view log entries in a \"parent-child\"\nformat using the Logs Explorer. Usually when you write log entries to\nCloud Logging, each log entry appears separately and uncorrelated. However,\nyou can group, or correlate your log entries by using the `trace` field in the\n[`LogEntry` object](/logging/docs/reference/v2/rest/v2/LogEntry).\n\nWhen you correlate log entries, you can view a parent log entry with multiple\nchild log entries in the Logs Explorer.\n\nSet up correlated log entries\n-----------------------------\n\nTo set up correlated log entries, you can manually populate the `trace` field,\nor you can instrument your application to submit traces to Cloud Trace by\nusing Google client libraries. The following configurations automatically\ncapture your trace data:\n\n- App Engine standard environment\n\n- Cloud Run functions and Cloud Run\n\nFor information on instrumenting your application to collect trace data, see\n[Overview to instrumenting for Cloud Trace](/trace/docs/setup).\n\nFor Logs Explorer to correlate a collection of log entries, the log entries\nmust meet the following requirements:\n\n- The `trace` field in the [`LogEntry` object](/logging/docs/reference/v2/rest/v2/LogEntry)\n is set to a string with the following format:\n\n projects/\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e/traces/\u003cvar translate=\"no\"\u003eTRACE_ID\u003c/var\u003e\n\n where \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e is your Google Cloud project project ID and\n \u003cvar translate=\"no\"\u003eTRACE_ID\u003c/var\u003e is the trace identifier.\n- The `trace` fields in the log entries are the same.\n\n- Each log entry belongs to a unique log. That is, the value of the `logName`\n fields must be different.\n\n| **Note:** Child log entries have a timestamp greater than or equal to the timestamp of the parent log entry. The parent log entry has the earliest timestamp.\n\nView correlated log entries in the Logs Explorer\n------------------------------------------------\n\nTo view the child log entries correlated with a parent log entry that you are\nviewing in the Logs Explorer, expand the log entry.\n\nFor example, to display your App Engine request log entry and application log\nentries, do the following:\n\n1. In the Google Cloud console, go to the **Logs Explorer** page:\n\n [Go to **Logs Explorer**](https://console.cloud.google.com/logs/query)\n\n \u003cbr /\u003e\n\n If you use the search bar to find this page, then select the result whose subheading is\n **Logging**.\n2. In the **Resource** drop-down menu, select **GAE Application**.\n\n3. In the **Log Name** drop-down menu, select `request_log`.\n\n4. In the **Query results** pane, to expand a log entry,\n click *chevron_right* **Expand**.\n\n Application log entries correlated to the request log entry are nested in the request log entry:\n\n In the previous screenshot, the parent log entry has 10 child log entries.\n You can expand these child log entries to view their details.\n\nSearch correlated log entries\n-----------------------------\n\nCorrelated search lets you search both parent and child log entries with a query.\nThe result of the search is a list of parent log entries that match the query in\neither the parent or child log entries. For example, to search for the string\n\"app log message\" in both the child and parent log entries, do the following:\n\n1. In the Google Cloud console, go to the **Logs Explorer** page:\n\n [Go to **Logs Explorer**](https://console.cloud.google.com/logs/query)\n\n \u003cbr /\u003e\n\n If you use the search bar to find this page, then select the result whose subheading is\n **Logging**.\n2. Enter `\"app log message`\" in the search field, and click **Run query** .\n Child log entries containing \"app log message\" are listed in the **Query\n results** pane.\n\n3. In the **Query results** pane, click **Correlate by** and select a parent\n log. To view App Engine request logs, select `request_log`, and click\n **Apply**.\n\n4. In the **Query results** pane, all parent log entries that contain the\n string `\"app log message\"` or that have a child that contain the string are\n listed.\n\n To view nested child log entries, tp expand the parent log entry,\n click *chevron_right* **Expand**.\n\n In the previous screenshot, the parent log entry has 10 child log entries\n that contain the string \"app log message\". You can expand these child log\n entries to view their details.\n\n If you selected a parent log and see no log entries in the **Query results**\n pane, then there are no correlated parent and child entries that match your\n query.\n\nWhat's next\n-----------\n\n- For information about instrumenting your application for Cloud Trace, see\n [Overview to instrumenting for Cloud Trace](/trace/docs/setup).\n\n- For information about App Engine request logs and application logs, see\n [Reading and writing application logs](/appengine/docs/legacy/standard/python)."]]
